> ## Documentation Index
> Fetch the complete documentation index at: https://docs.quintai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Glossary

> The words the dashboard uses, and what each one means.

The dashboard uses these words precisely. The docs use them the same way.

| Term | Meaning |
| - | - |
| **Agent** | An AI coding tool running on a machine, such as Claude Code, Cursor or Codex. The endpoint recognises it and attributes its activity to it. |
| **Session** | One run of an agent on one machine, from start to stop. Everything the agent does belongs to a session. |
| **Action** | One thing an agent did: a tool call, a file read or write, a shell command, a network connection. Each action carries a risk score and, when a rule matched it, a decision. |
| **Declared intent** | What an agent said it was about to do, recorded from the agent's own tool call before it ran. |
| **Observed behaviour** | What the machine then saw happen: the process, the files, the destinations. |
| **Divergence** | A gap between declared intent and observed behaviour. Divergence is how Quint finds risk; it is the mechanism's name, not the headline. |
| **Finding** | One divergence the platform recorded, shown under the risk it represents (for example "Credential read, then egress"). Findings are what you investigate. |
| **Risk score** | A number from 0 to 100 on an action or a session. It is a supporting signal for triage, not the thing that enforces. |
| **Watch profile** | Retired. Sensitive-path settings an organisation already declared still reach its machines; an administrator inspects or changes them through the API. |
| **Recap** | A scheduled summary of policy activity, as counts and rule names only, sent to one Slack, Teams or alert-webhook destination. Covers whole UTC days. Shown on **Policies › Alerts** as a scheduled summary. See [Alerts](https://docs.quintai.dev/policies/notifications.md). |
| **Match threshold** | Part of a recap: alert after N refuse matches during each fixed UTC hour, 6-hour block, day or ISO week. A refuse match is a match a rule would have refused in shadow mode, or did refuse when armed. A crossed threshold is a notification, not an incident. |
| **Ruleset** (policy pack) | A versioned, signed set of rules with a review-and-publish step. Each published version has a **serial**. |
| **Rule** | One disposition (ask, refuse, or record) over conditions across up to six matcher kinds. Conditions of different kinds are all required; within one kind, any one is enough. |
| **Match** | A rule noticed an action. A match is evidence, not a verdict: it does not mean the action was wrong. |
| **Shadow mode** | The mode every ruleset starts in. Rules only record. The dashboard shows what each rule *would have* done: "would have asked", "would have refused". |
| **Enforcement** | A ruleset that is armed asks or refuses at the moment of the action. Arming needs a workspace-level switch and a per-pack mode, and an owner or admin. |
| **Approval** | A tool call a workload's policy held for a person to decide. Approvals wait in the **Approvals** inbox and, when a channel is connected, in Slack or Teams. An approval nobody decides expires and is denied. |
| **Incident** | A grouped set of related findings or alerts that a person tracks to resolution. |
| **Workload** | A named group of agents that run in containers. It uses your organisation's rules and has its own runs, keys, approvers and network settings. See [Workloads](https://docs.quintai.dev/dashboard/workloads.md). |
| **Run** | One start of a container under a workload, from start to stop. Each run is listed on the workload's **Runs** tab, and its tool calls, connections and approvals are on the run's own page. |
| **Workload key** | The secret a container presents to register its runs under a workload. Created on the workload's **Keys** tab and shown once. Revoking or rotating a key stops the runs it started at their next heartbeat. |
| **Heartbeat** | The regular check-in a machine or a running container sends to Quint. A container run sends one about every 30 seconds. A stop, a revoked key or a changed network setting reaches a run at its next heartbeat. |
| **Machine** | One enrolled device. Listed under **Data Sources**. |
| **Install package** | The files an owner or admin makes in **Add machines** for a group of computers, holding a join code and the license. Downloadable once. Listed in **Settings › Machines & licensing**, where stopping it ends new joins and leaves joined computers running. |
| **Install code** | A one-time code an owner or admin makes in **Add machines** to add one computer. Shown once; stops working after 24 hours. |
| **Owner, Admin, Policy Writer, Read** | The four roles, highest first. Each role can do everything the one below it can. Read members see all workspace data; Policy Writers also triage findings and change the risk score limit; Admins also invite members, mint tokens, connect integrations and arm enforcement; the Owner also transfers or deletes the workspace. See [Roles and permissions](https://docs.quintai.dev/settings/roles-and-permissions.md). |
| **Retention** | How long each class of data is kept. Findings are kept 14 days, events 14 to 45 days, sessions 365 days. The full table is under **Settings › Data & retention** and in [Workspace and data](https://docs.quintai.dev/settings/workspace-and-data.md). |
| **Sentinel** | The AI analyst in the dashboard. It answers questions from your workspace's own rows, with citations, and can draft rules that open in the normal editor for you to save. |
| **Unknown** | A value the platform did not measure. The dashboard shows it as unknown, never as zero. An empty list is not an all-clear. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.